Append-only record of every consequential action, per tenant.
Every service that mutates state calls recordAudit() to append a row with actor identity, action name (e.g. "task.updated"), target ("task:xyz"), and free-form context. Under impersonation the row is stamped with actingAs. Drives automations (when-then), exports (CSV + JSON), and compliance replays.